What's New in Eclipse ioFog
v3.9.3 stays on the same Controller database. Startup adds the microservice supplemental groups column. No Control Plane YAML key was removed.
From v3.9.2, v3.9.1, or v3.9.0, bump image tags and roll Edgelet v1.1.3. From v3.8.0, use the same tags and move straight to v3.9.3. You also pick up the v3.9 catalogs and registry fields.
If you skipped v3.9.2 and the external issuer uses a private CA, set auth.issuerCa before you roll the operator. A public CA needs no new field. On Kubernetes, a Helm values file from chart 3.9.1 still needs the flat keys before helm upgrade. Chart 3.9.2 values stay valid.
If a NATS leaf relied on an implicit allow for $MQTT.>, add an explicit MQTT permission before you roll the 2.15.2 image.
See Upgrading to v3.9.3. v3.7.x and older still move to v3.8.0 first: Migrating to v3.8.0.
v3.9.3 adds host group IDs on microservices and refreshes the component pins. Pair Controller v3.9.3, iofogctl v3.9.3, Edgelet v1.1.3, Operator v3.9.3, Router v3.9.3, NATS 2.15.2, EdgeOps Console v1.1.2, and Go SDK v3.9.3.
- Platform train v3.9.3 lists the pins.
- Supplemental groups let a non-root process join the group that owns a device node.
- Interactive exec uses the remote PTY for stdin and window size.
- Embedded auth users can be created again with the same email after delete.
- NATS 2.15.2 embeds upstream NATS Server 2.15.2. Leaf ACLs no longer imply
$MQTT.>. - Edgelet v1.1.3 applies the group list and the exec session fixes.
- EdgeOps Console v1.1.2 edits supplemental groups and resizes shell tabs.
- v3.9 features (Model and Knowledge catalogs, registry
type, container fields) still apply when you come from v3.8.0. - Upgrade and migration paths summarize who can move in place.
Platform train v3.9.3
| Component | v3.9.3 default |
|---|---|
| Platform | v3.9.3 |
| Controller | v3.9.3 |
| iofogctl | v3.9.3 |
| Operator | v3.9.3 (Helm chart 3.9.3) |
| Router (wrapper image) | v3.9.3 (Skupper 3.5.3 inside) |
| NATS (wrapper image) | 2.15.2 (upstream NATS Server 2.15.2) |
| Edgelet | v1.1.3 (image 1.1.3) |
| EdgeOps Console | v1.1.2 (embedded in the Controller image) |
| Go SDK | v3.9.3 |
Pins and YAML keys: Control plane. Steps: Upgrading to v3.9.3.
Supplemental groups
container.supplementalGroups is a list of numeric host group IDs on a microservice. It is separate from runAsGroup, which stays the primary GID. A non-root process can join the group that owns a device node without isPrivileged: true.
container:
runAsUser: "1000"
runAsGroup: "1000"
supplementalGroups:
- 44
| Rule | Behavior |
|---|---|
| Shape | At most 16 unique whole numbers from 0 through 4294967295. Names, duplicates, negatives, and non-integers are rejected. |
| Stored order | The Controller sorts the ids ascending and returns them in that order. |
| Key omitted on update | The stored list stays. |
[] | Clears the stored list. |
| List changes | That workload is recreated. |
describe prints the key, including an empty list, so the next apply matches the Controller. The agent microservice list always includes supplementalGroups. [] means none.
The Controller adds column supplemental_groups on sqlite, mysql, and postgres during startup. Existing microservices start with no extra groups.
See Microservices and Microservice fields.
Interactive exec
iofogctl v3.9.3 forwards stdin to the remote PTY. Ctrl+C, Ctrl+D, exit, and logout go to the remote shell. The local session ends when the remote side closes, or when local stdin reaches EOF.
The CLI sends the terminal size when the session starts. On Unix it sends a new size when the window changes. Windows sends the size once.
Edgelet accepts a resize frame after the shell has started: {"type":"resize","cols":N,"rows":M}. Columns run from 2 through 4096. Rows run from 1 through 4096. When the shell finishes, remaining output is sent before the close frame.
See Logs and exec and Exec sessions.
Embedded auth users
Deleting a built-in user removes the account. You can create a user with that email again. A row left by an earlier soft delete is removed when that email is claimed. The bootstrap admin and the signed-in account cannot be deleted.
See Identity and sign-in.
NATS 2.15.2
NATS image tag 2.15.2 embeds upstream NATS Server 2.15.2. Wrapper NATS_* settings are unchanged. Go stays 1.26.10.
This upstream release fixes auth-callout allowed connection types, a queue-subscription weight amplification, OCSP responses bound to the wrong certificate serial, leafnode ACLs that implicitly allowed $MQTT.>, and MQTT OCSP ignoring ocsp_peer.
Leafnode ACLs no longer add an implicit allow for $MQTT.>. If a leaf relied on that allow, add an explicit MQTT permission before you roll the image.
Router image tag 3.9.3 still embeds Skupper Router 3.5.3. The wrapper behavior is unchanged. The operator image and Helm chart move to 3.9.3 with the same flat values file as chart 3.9.2.
See NATS Server, Router, and Kubernetes with Helm.
Edgelet v1.1.3
Edgelet v1.1.3 pairs with Controller v3.9.3. Upgrade fleet nodes after you roll the control plane. Default image: edgelet:1.1.3 on your flavor registry.
Local deploy and Controller-managed workloads accept supplementalGroups. Omitting the field leaves an existing workload unchanged. Changing the list recreates that container. Docker and Podman receive the ids as extra groups. The primary user and group stay as written.
Each published binary ships a CycloneDX file and an SPDX file next to the binary.
Upgrade on a node:
sudo sh /usr/share/edgelet/install.sh --upgrade --version=v1.1.3
Or use upgrade agent as described in Upgrade and rollback Edgelet.
See Edgelet nodes, Edgelet introduction, and Edgelet management.
EdgeOps Console
EdgeOps Console v1.1.2 ships embedded in the Controller image (default port 8008). The YAML editor and the microservice detail panel keep Supplemental Groups separate from Run As Group.
Shell tabs use the remote terminal size. The visible tab owns that size, and a resize updates the session.
Open with iofogctl view or controller.consoleUrl.
See EdgeOps Console, Console features, and Workloads.
AI Model and Knowledge catalogs
v3.9 adds fleet kind: Model and kind: Knowledge resources. The Controller pulls weights or datasets from type: hf or type: oci registries, tracks attach state per Edgelet node, and mounts ready content into microservices.
| Catalog | Purpose | Microservice bind |
|---|---|---|
| Model | LLM and inference weights (GGUF, safetensors, OCI model-spec) | spec.models.items[] |
| Knowledge | RAG corpora, Hub datasets, OCI document bundles | spec.knowledge.items[] |
Console path: Config → AI Model Catalog and Config → AI Knowledge Catalog. CLI: deploy, describe model, attach model, and the matching knowledge commands.
Edgelet nodes can also hold local edgelet.iofog.org/v1 models for lab workflows. Fleet operators usually use the Controller catalog.
See AI Model Catalog, AI Knowledge Catalog, and Microservices.
Registries (OCI and Hugging Face)
Registry rows declare a backend with spec.type: oci (container registries) or hf (Hugging Face Hub). Private Hub pulls use a token in password.
v3.9 removes requiresCert, certificate, and isSecure. Use optional ca (PEM or base64) and insecure for lab TLS instead.
Microservices and catalog items reference registries by numeric ID or aliases remote / local.
See Registries and Catalog microservices.
Microservice container fields
spec.container on microservices includes OCI runtime options:
- Resource limits:
cpus,memoryReservation,memorySwap,shmSize - Security:
runAsGroup,supplementalGroups,readOnlyRootFilesystem,capAdd/capDrop - Devices and mounts:
devices,tmpfs,cdiDevices, volumescopefor named volumes - Process:
workingDir,entrypoint,commands,ulimits,sysctls
Wasm and alternate runtimes still use container.platform and container.runtime with runtime classes.
See Microservices and Microservice fields.
Upgrade and migration paths
| Starting version | Path |
|---|---|
| v3.9.2, v3.9.1, or v3.9.0 | In-place tag bump: Upgrading to v3.9.3 |
| v3.8.0 | In-place upgrade: Upgrading to v3.9.3 |
| v3.7.x or v1.6.x | Greenfield to v3.8 first: Migrating to v3.8.0, Documentation archive |
| Greenfield v3.9.3 | Quick start (local) or Platform deployment |
After upgrade, reconcile stalled platform microservices on Controller hosts if Router or NATS pods look stale: Reconcile.
v3.8 foundation
v3.8.0 introduced Edgelet-only nodes, embedded OIDC, EdgeOps Console in the Controller image, WebSocket exec, multi-arch images[] catalogs, and the greenfield migration from v3.7. That behavior still applies on v3.9. The v3.8.0 docs snapshot keeps the full v3.8 release narrative and greenfield warnings.
New to the platform? Start with Welcome, Learn, and the Acme Smart Plant tutorial on pot-edge-patterns v1.1.1 images.
CLI and Go SDK
iofogctl v3.9.3 passes container.supplementalGroups through on deploy and describe for Application, Microservice, and MicroserviceTemplate YAML. Interactive exec uses the remote PTY, as described above. Config directory remains ~/.iofog/v3.
Go SDK v3.9.3 adds supplementalGroups on the microservice container. GET returns an array ([] when there are none). On YAML, omit the key to leave the stored list unchanged. An empty list clears it.
See CLI introduction, iofogctl getting familiar, and Go SDK.